Forensics, Ch 4 Disk Volume and Partition Systems

bytes 32 - 39

(starting address of the partition): sector 32 (0x0022).

is a partition whose entry is in the MBR, and the partition contains additional partitions.

A primary extended partition

is a partition whose entry is in the MBR and the partition contains a file system or other structured data.

A primary file system partition

What replaced bios

Extensible Firmware Interface and Unified EFI

Bytes 16 - 31:

Partition GUID

Each MBR entry has following fields:

Starting CHS address (for Windows 98, ME, etc.) Ending CHS address Starting LBA address (for Windows 2000 and beyond) Number of sectors in partition Type of partition (FAT, NTFS, etc., Linux does not care the type) Flags (bootable or not)

When it finds such a partition, Boot Code looks in the first sector of the partition

and executes the code found there.

MBR includes how many partitions?

one partition table which has four entries. (meaning up to 4 partitions)

is a partition that contains a partition table and a secondary file system partition.

A secondary extended partition

also called a logical partition in Windows, is located inside the primary extended partition bounds and contains a file system or other structured data.

A secondary file system partition,

What is getting obsolete

BIOS uses MBR

contains a backup copy of the partition table and the GPT header (in this order, meaning a backup copy of the GPT header is the last sector of the GPT). It is located in the sector following the partition area.

Backup area

exists in the first 446 bytes of the first sector (512-byte)

Boot Code MBR

Protective MBR uses single entry is for a partition with a type of 0xEE that spans

the entire disk.

What are essential and specified in the partition data structure

the starting and ending locations (sectors) for each partition

What is the purpose of a partition system is

to organize the layout of a volume

Bytes 0 -15

(Partition type GUID): MRP type

bytes 40 - 47

(ending address of the partition): sector 4,096,000 (0x003E8000).

the largest area and contains the sectors that will be allocated to partitions. The starting and ending sectors for the entire partition area (not the each partition area) are defined in the GPT header

Partition Area

Each entry contains a starting and ending address, a type value, a name, attribute flags, and a GUID value.

Partition table

What contains a DOS partition table with one entry.

Protective MBR

What are partitions for windows, mac, linux

Windows: FAT, NTFS MAC: HFS, HFS+ Linux: Ext2

Boot sector viruses or Bootkits insert themselves into the first 446 bytes of the MBR so that they are executed

every time the computer is booted.

What is an example of a volume that is located in consecutive sectors

hard disk

Multiple OS boot option code can be either in Boot Code or

in the bootable partition

Where is the Master Boot Record (MBR)

in the first 512-byte sector of a disk

The sectors in a volume need _______ be consecutive on a physical storage device

not

What is a collection of consecutive sectors in a volume that is also known as a volume and dependent on the operating system and not the type of interface on the hard disk

partition

What does the partition exists in Protective MBR

so that legacy computers can recognize the disk as being used and do not try to format it.

What processes the partition table in the MBR and identifies which partition has the bootable flag set.

standard Microsoft boot code

GPT header

starts in sector 1 (typically fits in 1 sector) defines the size and location of the partition table, which are fixed when the GPT disk is created. Windows limits the number of entries in the partition table to 128. also contains a checksum of the header and the partition table so that errors or modifications can be detected.

What is a collection of addressable sectors that an Operating System (OS) or application can use for data storage.

volume

The code in the start of the partition

will be operating system-specific.

What is supposed to be unique for that system and is set when the partition table is created.

The 128- bit GUID

What do EFI and UEFI use instead of MBR

GPT

What GPT partition type has unallocated entry

Intel

DOS, Windows, Linux, and IA32-based FreeBSD and OpenBSD systems all contain which partitions

DOS

What is used mainly in systems with 64 bit Intel processors

EFI/UEFI

GUID stands for

Globally Unique ID can support up to 128 partitions and uses 64-bit LBA addresses

What section of a partition do not have boundary information

The starting and ending sectors